How do I update Palo Alto app and threat metadata in Splunk Enterprise Security

[MonkeyK]

pancontentpack is supposed to get app and threat metadata from Panorama.

I noticed that pancontentpack is only part of the Palo Alto App, not the Add-on. Since I cannot install the App to my ES search head (too bad, considering it's datamodel is more useful to me than Network_Traffic), I cannot update the metadata on ES search head.

Can I just copy pancontentpack.py to ES?

My other option appears to be to manually copy the csv contents from one search head to the other.

[btorresgil · Accepted solution]

Hi MonkeyK, moving the pancontentpack.py file will likely not work since it depends on some libraries. If you move all the libraries too, it might work, but we'd be unable to support it. We put this script in the App because at the time that was the recommended way. Now the lines between App and Add-on have blurred with additions like Adaptive Response, so we could consider moving this script to the Add-on in a future version. Thank you for the feedback!

I opened a github issue here to track this. If anyone has an opinion on where this script should live (app or add-on) please offer it here:
https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/issues/62

Thanks!
-Brian

[MonkeyK]

Thanks Brian! What you are saying makes sense and I will add my vote for having it in the Add-on since I cannot have the App in Splunk ES.